Page and component permissions for Drupal Canvas
A new Canvas module for the times when team managing the site grows: decide who edits which pages and uses which components.
Last time I promised a post about the modules I've been building to extend Canvas. Here's the first one.
Canvas has a simple access model today. Editors that can edit one page, can edit all of them, and they can use any components available in the component library. That's fine for a small team. It's more challenging with larger teams where you have developers, corporate marketing, and regional teams doing different tasks.
Canvas Access adds an Access section inside Canvas where you decide who can do what.
Pages
Group pages into folders, and pick the roles and people who can edit each folder. A single page can have its own access when it needs to be the exception. Editors only see the pages they can edit, so nobody has to learn which ones to stay away from. Folders are stored in config and when you use role based permissions, you can deploy your configuration with config sync.
Components
Restrict a component folder, and everyone else stops seeing those components in the library. Components that are already on a page keep working. Other editors can still change their settings, they just can't add more of them. Code components work the same way, except there you choose who gets to edit the code. This can be useful for example in cases where you need some special components for the homepage or a Content Template and you don't want it used elsewhere.
Checking your work
My experience is that setting up permissions is easy but it's hard to verify that you've configured the permissions correctly. Canvas Access allows picking a person or a role, and it tells you what they can edit and why: the role that let them in, the folder that kept them out, or the permission they're missing.
What it doesn't do yet
Folders are configured in the Canvas Access UI and they are not reflected in the pages list. Ideally we can change that in future. I'm also thinking that we may need ways to configure default permissions that are assigned to new pages.
It's early and there's no stable release yet, so try it on a test site first. If something breaks or you have ideas on how to improve the module, feel free to file an issue in the issue queue.